> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://support.contracthero.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Automatic backups: a daily copy in your own storage # Automatic backups: a daily backup to your own storage *The screenshots in this article show the German interface. The English label is given first, with the German label in square brackets.* ## Your benefit You are not dependent on ContractHero as the sole storage location: the backups are written directly to storage that you manage and have access to. That simplifies internal compliance and GDPR requirements (availability, recoverability), gives your IT team a clean recovery option in an emergency and builds trust during audits — your contract data never leaves your area of responsibility. Automatic backups are part of the **Enterprise** plan. ## How it works **1. Open the backup area** Go to **Settings [Einstellungen]** ![](https://storage.crisp.chat/users/helpdesk/website/-/1/2/5/2/12522a019f980500/screenshot-2026-05-29-at-11060_1bpetni.png) Then go to Backup. ![](https://storage.crisp.chat/users/helpdesk/website/-/1/2/5/2/12522a019f980500/screenshot-2026-05-29-at-11064_1u8fjaq.png) You will see the **Backup methods [Backup-Methoden]** card with the subtitle "Configuration for automatic backups via AWS S3, SFTP or FTPS server" [Konfiguration für automatische Backups über AWS S3, SFTP oder FTPS-Server] and the selection **Please select the server [Bitte wählen Sie den Server]**. **2. Select the server type** Choose one of the four methods: * **AWS S3** — backup to your Amazon S3 bucket. Recommended if your organisation already works in AWS. * **Custom S3** — backup to S3-compatible storage from other providers (e.g. Wasabi, Backblaze B2, MinIO, your own S3 implementation). * **SFTP** — backup via SFTP to a classic server (default port 22). * **FTPS** — backup via FTPS (FTP over TLS, default port 21). **3. Enter the connection details** Depending on the method, fill in the following mandatory fields: * **AWS S3**: Storage class (default: "S3 Glacier Flexible Retrieval"), Bucket, Access Key, Secret Access Key, Region (default: eu-central-1). * **Custom S3**: Endpoint URL [Endpunkt-URL] (the full URL for your S3-compatible storage, e.g. `https://s3.your-provider.com`), Bucket, Access Key, Secret Access Key. * **SFTP / FTPS**: Hostname, Port, Username, Password [Passwort], Path (target directory on the server). Optional: **Password for the zip file [Passwort für die Zip-Datei]** — if this is set, ContractHero additionally encrypts the backup archive with this password. Recommended if the target storage is only partially secured or if third parties could have read access. **4. AWS S3 — set the IAM permissions** For AWS S3, ContractHero shows a ready-made IAM policy in the help area on the right, with only the rights that are needed (`s3:PutObject`). Use **Copy to clipboard [In die Zwischenablage kopieren]** to transfer the JSON straight into your AWS console and create a new IAM user exclusively for ContractHero backups. Enter that user's Access Key and Secret in the backup configuration. ContractHero's recommendation: **enable bucket versioning**, so that you keep several versions of every backup and can also restore older states. **5. Save the configuration** Click **Update [Aktualisieren]**. From the next scheduled backup run onwards, the data will be written to the storage you have configured. **6. Check the ongoing backups** At the bottom of the backup page you will find the **Latest actions [Letzte Aktionen]** card with the history of all backup activity and of any errors that have occurred. For each entry you can see **Created at [Erstellt am]**, **Status** and **Message [Nachricht]** — the quickest way to check whether the backups are running successfully. ## Frequently asked questions **How often is a backup created?** Once a day, automatically — you do not have to trigger the run manually. **What exactly is backed up?** Your contracts, including contract data and documents. This means your ContractHero records can be restored independently of the service. **Which plans can use automatic backups?** Automatic backups are part of the **Enterprise** plan. In all other plans the Backup menu item is not visible, unless you have purchased this add-on. **Where are the backups located physically?** In the storage that you configure — your own S3 bucket, your own SFTP/FTPS server. ContractHero does not keep a copy outside this destination. ContractHero itself does of course create backups at regular intervals, for security reasons. **Can I run several backup destinations in parallel?** At present, exactly one active backup destination per organisation is provided for. If you want to switch destinations, adjust the configuration and click **Update [Aktualisieren]**. **What happens if a backup fails?** The error appears in **Latest actions [Letzte Aktionen]** with a status and a message (e.g. "Access Denied", "Bucket not found" [Bucket nicht gefunden]). Correct the connection details or the permissions; the next regular run will repeat the attempt. **Do I need my own AWS account?** For the **AWS S3** method, yes — you need an AWS account with a bucket and an IAM user with `s3:PutObject` rights. If you do not have an AWS account, **Custom S3**, **SFTP** or **FTPS** are alternatives. ## Good to know * **Security at the target system is your responsibility.** ContractHero writes backups to the storage you configure — as the operator, you are responsible for access control (IAM, SFTP user, firewall) and for encryption at the destination. * **The zip password as an additional layer.** The optional password for the zip file is a layer of encryption on top of the transport and storage encryption — useful if the target storage is managed by a third party. * **IAM best practice for AWS S3.** Do not use a root account or an administrative IAM user for the backup credentials. The policy suggested in the interface contains `s3:PutObject` only — no read, delete or listing rights. * **Bucket versioning recommended.** This keeps backups from being overwritten accidentally and lets you go back to earlier daily states. * **Default region eu-central-1.** For AWS S3, Frankfurt is preset — relevant from a GDPR point of view if no other region is necessary. ## Related articles * How can roles and permissions be managed for additional users? * What is the Advanced Permission Concept (APC)? * How do I set up SSO?